@seams/wallet-server 0.7.3 → 0.9.0

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationSetup.d.ts

@@ -31,38 +31,12 @@
  * allocation and insertion are the same request. Genuine uniqueness is still
  * arbitrated where it always was, by the wallet table at commit.
  */
-import { type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type RegistrationAuthMethodInput } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import { type RegistrationSignerSetSelection } from '../../../../../../shared-ts/src/utils/registrationSignerPlan';
-import { type RegisterWalletInput, type RegistrationAuthMethodInput } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
-import type { RespondEd25519DeferredWorkV2, WalletRegistrationRespondResponseV2, WalletRegistrationSetupResponseV2 } from '../../../../core/threeRouteRegistrationContracts';
 import type { StoredWalletRegistrationCeremony } from '../../../../core/RegistrationCeremonyStore';
-import { mintSignedWalletRegistrationSetup, type WalletRegistrationSetupMinter } from '../../../domains/walletRegistration/walletRegistrationSetupPayload';
+import type { RespondEd25519DeferredWorkV2, WalletRegistrationRespondResponseV2, WalletRegistrationSetupResponseV2 } from '../../../../core/threeRouteRegistrationContracts';
 import type { WalletRegistrationSetupRequest } from '../../../domains/walletRegistration/walletRegistrationInputs';
-export declare function walletRegistrationSetupIds(): {
-    readonly registrationCeremonyId: string;
-    readonly registrationPreparationId: string;
-};
-/**
- * Resolves the wallet id without reserving it.
- *
- * A provided id is taken as given; an absent or server-allocated one is
- * generated. There is no existence pre-check: it cost a serialized read on
- * every registration to catch a collision that the commit-time uniqueness
- * constraint catches anyway, and for a freshly generated random id it could
- * essentially never fire.
- */
-export declare function resolveWalletRegistrationSetupWalletId(input: {
-    readonly wallet: RegisterWalletInput | undefined;
-    readonly parseProvided: (raw: unknown) => WalletId | null;
-    readonly createServerAllocated: () => WalletId;
-}): {
-    readonly ok: true;
-    readonly walletId: WalletId;
-} | {
-    readonly ok: false;
-    readonly code: string;
-    readonly message: string;
-};
+import { mintSignedWalletRegistrationSetup, type WalletRegistrationSetupMinter } from '../../../domains/walletRegistration/walletRegistrationSetupPayload';
 export declare function normalizeWalletRegistrationSetupRequest(request: WalletRegistrationSetupRequest): {
     readonly ok: true;
     readonly signerSelection: RegistrationSignerSetSelection;
@@ -82,7 +56,6 @@ export declare function buildWalletRegistrationSetupSignature(input: {
     readonly expectedOrigin: string;
 }): Promise<{
     readonly signedSetup: Awaited<ReturnType<typeof mintSignedWalletRegistrationSetup>>;
-    readonly setupDigestB64u: string;
 }>;
 export declare function walletRegistrationSetupIntentDigest(intent: StoredWalletRegistrationCeremony['intent']): Promise<string>;
 /**

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.d.ts

@@ -0,0 +1,16 @@
+import type { WalletSessionHome } from '../../../../../../shared-ts/src/device-linking/contracts';
+import type { WalletRegistrationSetupResponseV2 } from '../../../../core/threeRouteRegistrationContracts';
+import { type RouterAbEcdsaStrictRegistrationPort } from '../../../domains/ecdsa/routerAbEcdsaStrictRegistration';
+import type { WalletRegistrationSetupInput } from '../../../domains/walletRegistration/walletRegistrationInputs';
+import type { RegistrationWalletStarter, WalletRegistrationReservationAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
+import { CloudflareD1RegistrationCeremonyIntentStore } from './d1RegistrationCeremonyStore';
+type WalletRegistrationSetupDependencies = {
+    readonly home: WalletSessionHome;
+    readonly reservation: Pick<WalletRegistrationReservationAuthority, 'reserve'> | null;
+    readonly store: CloudflareD1RegistrationCeremonyIntentStore;
+    readonly ecdsaStrictRegistration: RouterAbEcdsaStrictRegistrationPort;
+    readonly startRegistrationWallets: RegistrationWalletStarter | null;
+};
+export declare function executeD1WalletRegistrationSetup(input: WalletRegistrationSetupInput, dependencies: WalletRegistrationSetupDependencies): Promise<WalletRegistrationSetupResponseV2>;
+export {};
+//# sourceMappingURL=d1WalletRegistrationSetupExecution.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.d.ts

@@ -1,11 +1,11 @@
+import type { RegistrationActivationWrite, WalletRegistrationHomeAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
 import type { WalletRegistrationEd25519YaoPublicResult } from '../../../../core/registrationContracts';
 import type { WalletRegistrationFinalizeAuthMethod } from '../../../../../../shared-ts/src/utils/registrationContracts';
 import { type VerifiedOwnerProof } from '../../../../authorization/factorEvidence';
-import type { AuthorizationService } from '../../../../authorization/service';
-import type { LiveWalletSessionAuthorizationProjectionV2 } from '../../../../authorization/domain';
+import type { AuthorizationGrantPort, AuthorizationService } from '../../../../authorization/service';
+import type { DirectV2IssueResult, LiveWalletSessionAuthorizationProjectionV2 } from '../../../../authorization/domain';
 import type { EcdsaDerivationServerBootstrapResponse } from '../../../../core/types';
 import type { WalletRegistrationSessionCommitReceiptV2 } from '../../../../core/threeRouteRegistrationContracts';
-import type { StoredRegistrationAuthority } from '../../../../core/RegistrationCeremonyStore';
 import { type PrincipalId, type TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
 import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
 import { type WalletAuthMethodId } from '../../../../../../shared-ts/src/utils/domainIds';
@@ -13,18 +13,40 @@ import { type WalletAuthAuthority } from '../../../../../../shared-ts/src/utils/
 import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
 import type { RegistrationEstablishedSessionProjectionTokensV2, RegistrationEstablishedSessionProjectionV2, RegistrationEstablishedSessionResultV2, RegistrationEstablishedSessionV2 } from '../../../../../../shared-ts/src/utils/registrationEstablishedSession';
-type RegistrationEstablishedSessionIssuerAuthorizationService = Pick<AuthorizationService, 'issueDirectWalletSessionAuthorizationV2' | 'issueDirectRegistrationPromotedWalletSessionAuthorizationV2' | 'readWalletSessionAuthorizationV2ByMint' | 'readWalletSessionAuthorizationV2ByAuthorizationId' | 'refreshWalletSessionAuthorizationV2AuthorityProjection'>;
-type RegistrationEstablishedSessionIssuerWalletAuthMethodReader = {
-    readonly readActiveRegistrationAuthority: (authority: StoredRegistrationAuthority) => Promise<{
-        readonly authority: ActiveWalletAuthorityV1;
-        readonly walletAuthMethodId: WalletAuthMethodId;
-    } | null>;
-};
+type RegistrationEstablishedSessionIssuerAuthorizationService = Pick<AuthorizationService, 'commitDirectWalletSessionAuthorizationV2' | 'readWalletSessionAuthorizationV2ByMint' | 'readWalletSessionAuthorizationV2ByAuthorizationId' | 'refreshWalletSessionAuthorizationV2AuthorityProjection'>;
 type RegistrationEstablishedSessionIssuanceDependencies = {
     readonly authorizationService: RegistrationEstablishedSessionIssuerAuthorizationService;
     readonly authorizationTenantId: TenantId;
-    readonly walletAuthMethods: RegistrationEstablishedSessionIssuerWalletAuthMethodReader;
+    readonly foundingAuthority: ActiveWalletAuthorityV1;
+    readonly homeCompletion: Pick<WalletRegistrationHomeAuthority, 'publishEstablished'>;
+};
+export type RegistrationInitialSessionCommit = {
+    readonly kind: 'uncommitted';
+    readonly value?: never;
+} | {
+    readonly kind: 'committed';
+    readonly value: Awaited<ReturnType<AuthorizationService['commitDirectWalletSessionAuthorizationV2']>>;
 };
+type InitialEd25519RegistrationSessionInput = {
+    readonly authorizationService: RegistrationEstablishedSessionIssuerAuthorizationService;
+    readonly authorizationTenantId: TenantId;
+    readonly foundingAuthority: ActiveWalletAuthorityV1;
+    readonly registrationCeremonyId: string;
+    readonly authority: WalletAuthAuthority;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly expiresAtMs: number;
+    readonly remainingUses: number;
+    readonly proof: Extract<VerifiedOwnerProof, {
+        readonly purpose: 'wallet_session';
+    }>;
+};
+export declare function commitInitialEd25519RegistrationSession(input: InitialEd25519RegistrationSessionInput, commitSession?: AuthorizationGrantPort['commitDirectReplayableWalletSessionAuthorizationV2']): Promise<{
+    readonly result: DirectV2IssueResult;
+    readonly publication: import("../../../../cloud-host").WalletSessionLocatorPublication & {
+        readonly kind: "credential";
+    };
+    readonly registration: import("../../../..").DirectV2CommitResult["registration"];
+}>;
 export declare function walletSessionPrincipalId(authority: WalletAuthAuthority): PrincipalId;
 export declare function buildRegistrationOwnerProof(input: {
     readonly registrationCeremonyId: string;
@@ -36,7 +58,7 @@ export declare function buildRegistrationOwnerProof(input: {
 }): Promise<Extract<VerifiedOwnerProof, {
     readonly purpose: 'wallet_session';
 }>>;
-export type RegistrationEstablishedSessionIssuanceResultV2 = {
+export type RegistrationEstablishedSessionIssuanceResultV2 = ({
     readonly kind: 'issued';
     readonly session: RegistrationEstablishedSessionV2;
     readonly issuedAtMs: number;
@@ -45,6 +67,12 @@ export type RegistrationEstablishedSessionIssuanceResultV2 = {
     readonly session: RegistrationEstablishedSessionProjectionV2;
     readonly next: 'unlock_exact_method';
     readonly issuedAtMs: number;
+}) & {
+    /**
+     * The home's activation, which the caller commits with the record that
+     * completes its operation. None when the home is already active.
+     */
+    readonly activation: RegistrationActivationWrite | null;
 };
 export type Ed25519RegistrationSessionPredecessor = {
     readonly kind: 'ed25519_only';
@@ -73,7 +101,6 @@ export declare function assertDirectWalletSessionOwnerProof(input: {
 export declare function issueDirectRegistrationEstablishedEcdsaSession(input: RegistrationEstablishedSessionIssuanceDependencies & {
     readonly registrationCeremonyId: string;
     readonly authority: WalletAuthAuthority;
-    readonly registrationAuthority: StoredRegistrationAuthority;
     readonly walletAuthMethodId: WalletAuthMethodId;
     readonly expiresAtMs: number;
     readonly remainingUses: number;
@@ -87,16 +114,17 @@ export declare function issueDirectRegistrationEstablishedEcdsaSession(input: Re
 export declare function issueDirectRegistrationEstablishedEd25519Session(input: RegistrationEstablishedSessionIssuanceDependencies & {
     readonly registrationCeremonyId: string;
     readonly authority: WalletAuthAuthority;
-    readonly registrationAuthority: StoredRegistrationAuthority;
     readonly walletAuthMethodId: WalletAuthMethodId;
     readonly expiresAtMs: number;
     readonly remainingUses: number;
     readonly publicResult: WalletRegistrationEd25519YaoPublicResult;
     readonly predecessor: Ed25519RegistrationSessionPredecessor;
+    readonly initialSession: RegistrationInitialSessionCommit;
     readonly keyManifestDigestB64u: DigestB64u;
     readonly proof: Extract<VerifiedOwnerProof, {
         readonly purpose: 'wallet_session';
     }>;
+    readonly onSessionCommitted?: (session: RegistrationEstablishedSessionProjectionV2) => Promise<void>;
 }): Promise<RegistrationEstablishedSessionIssuanceResultV2>;
 export declare function projectCurrentNearRegistrationSession(authorization: LiveWalletSessionAuthorizationProjectionV2, tokens: Extract<RegistrationEstablishedSessionProjectionTokensV2, {
     readonly kind: 'near_ed25519_and_evm_family_ecdsa';

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.d.ts

@@ -1,5 +1,6 @@
 import type { WalletRegistrationFinalizeResponse, WalletRegistrationFinalizeSuccess } from '../../../../core/registrationContracts';
 import type { WalletRegistrationFinalizeAuthMethod } from '../../../../../../shared-ts/src/utils/registrationContracts';
+import type { RegistrationActivationWrite } from '../../../domains/walletRegistration/walletRegistrationReservation';
 import type { WalletRegistrationActivateResponseV2, WalletRegistrationCommittedInstallationProjectionV1, WalletRegistrationSessionCommitReceiptV2 } from '../../../../core/threeRouteRegistrationContracts';
 import type { RegistrationEstablishedSessionResultV2 } from '../../../../../../shared-ts/src/utils/registrationEstablishedSession';
 import { type WalletSessionMintId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
@@ -14,23 +15,23 @@ export type RegistrationCommitExecution<T> = {
 } | {
     readonly kind: 'replayed';
     readonly response: T;
-} | {
-    readonly kind: 'near_pending';
-    readonly response: T;
-    readonly expectedOrigin: string;
 } | {
     readonly kind: 'session_issued';
     readonly response: T;
     readonly issuedAtMs: number;
     readonly expectedOrigin: string;
+    readonly activation: RegistrationActivationWrite | null;
     readonly installationProjection?: never;
 } | {
     readonly kind: 'session_issued_with_installation_projection';
     readonly response: T;
     readonly issuedAtMs: number;
     readonly expectedOrigin: string;
+    readonly activation: RegistrationActivationWrite | null;
     readonly installationProjection: WalletRegistrationCommittedInstallationProjectionV1;
 };
+/** The home activation that a commit left for the record that completes its operation. */
+export declare function registrationCommitActivation<T>(execution: RegistrationCommitExecution<T>): RegistrationActivationWrite | null;
 export declare function unissuedRegistrationCommit<T>(response: T): RegistrationCommitExecution<T>;
 export declare function replayedRegistrationCommit<T>(response: T): RegistrationCommitExecution<T>;
 export declare function projectWalletRegistrationSessionCommitReceiptV2(input: {

package/dist/types/wallet-server/src/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.d.ts

@@ -33,5 +33,28 @@ export declare class D1EcdsaAdmissionPolicyRead {
         readonly curve: 'ecdsa';
     }): RouterAbNormalSigningPolicyDecision | null;
 }
-export declare const ECDSA_CREDENTIAL_POLICY_PROJECTION = "\n  (WITH candidates AS (\n     SELECT DISTINCT json_extract(signer.record_json, '$.runtimePolicyScope') AS scope_json\n       FROM wallet_signers AS signer\n      WHERE signer.namespace = session.namespace AND signer.org_id = session.org_id\n        AND signer.project_id = session.project_id AND signer.env_id = session.env_id\n        AND signer.wallet_id = session.wallet_id AND signer.signer_family = 'ecdsa'\n        AND json_valid(signer.record_json)\n   ), scopes AS (\n     SELECT scope_json,\n            json_extract(scope_json, '$.orgId') AS org_id,\n            json_extract(scope_json, '$.projectId') AS project_id,\n            json_extract(scope_json, '$.envId') AS env_id,\n            json_extract(scope_json, '$.signingRootVersion') AS signing_root_version,\n            json_extract(scope_json, '$.orgId') || char(31) ||\n            json_extract(scope_json, '$.projectId') || char(31) ||\n            json_extract(scope_json, '$.envId') || char(31) ||\n            json_extract(scope_json, '$.signingRootVersion') AS project_key\n       FROM candidates\n   )\n   SELECT json_group_array(json_object(\n     'scope_json', scopes.scope_json,\n     'project_key', project.record_key, 'project_decision', project.decision,\n     'project_retry_after_ms', project.retry_after_ms,\n     'abuse_key', abuse.record_key, 'abuse_decision', abuse.decision,\n     'abuse_retry_after_ms', abuse.retry_after_ms))\n     FROM scopes\n     LEFT JOIN router_ab_normal_signing_admission_records AS project\n       ON project.namespace = session.namespace AND project.org_id = scopes.org_id\n      AND project.project_id = scopes.project_id AND project.env_id = scopes.env_id\n      AND project.signing_root_version = scopes.signing_root_version\n      AND project.record_kind = 'project_policy' AND project.record_key = scopes.project_key\n     LEFT JOIN router_ab_normal_signing_admission_records AS abuse\n       ON abuse.namespace = session.namespace AND abuse.org_id = scopes.org_id\n      AND abuse.project_id = scopes.project_id AND abuse.env_id = scopes.env_id\n      AND abuse.signing_root_version = scopes.signing_root_version\n      AND abuse.record_kind = 'abuse'\n      AND abuse.record_key = scopes.project_key || char(31) || session.wallet_id || char(31) ||\n          'material_activation:' || ? || char(31) || 'ecdsa'\n  ) AS ecdsa_policy_records_json,";
+/** Policy rows read with an Ed25519 Wallet Session, for the scopes of its signer. */
+export declare class D1Ed25519AdmissionPolicyRead {
+    #private;
+    private readonly database;
+    private readonly namespace;
+    private readonly walletId;
+    private readonly authorityId;
+    private constructor();
+    static fromRows(database: D1DatabaseLike, namespace: string, walletId: string, authorityId: string, rows: unknown): D1Ed25519AdmissionPolicyRead;
+    /**
+     * Null sends the caller to the database: another store, or a scope this read
+     * did not select. Linked-device material has no signer row to select from.
+     */
+    resolve(database: D1DatabaseLike, namespace: string, input: Ed25519WalletAuthorityAdmissionInput): RouterAbNormalSigningPolicyDecision | null;
+}
+type Ed25519WalletAuthorityAdmissionInput = Extract<RouterAbNormalSigningAdmissionInput, {
+    readonly curve: 'ed25519';
+    readonly authorityKind: 'wallet_authority_v1';
+}>;
+/** Binds the material activation id. */
+export declare const ECDSA_CREDENTIAL_POLICY_PROJECTION: string;
+/** Binds the signer scope (namespace, organization, project, environment) and the activation id. */
+export declare const ED25519_CREDENTIAL_POLICY_PROJECTION: string;
+export {};
 //# sourceMappingURL=d1RouterAbNormalSigningAdmissionStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.d.ts

@@ -1,4 +1,4 @@
-import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { D1DatabaseLike, D1PreparedStatementLike, D1ResultLike } from '../../../../storage/tenantRoute';
 import type { VersionedJsonObject, VersionedJsonRecordPutResult, VersionedJsonRecordReadResult } from '../../../framework/versionedJsonRecordStore';
 export type CloudflareD1VersionedJsonRecordScopeV1 = {
     readonly namespace: string;
@@ -32,6 +32,10 @@ export type CloudflareD1VersionedJsonRecordBatchPutResultV1 = {
     readonly kind: 'version_mismatch';
     readonly key: string;
 };
+type StoredRecord = {
+    readonly version?: unknown;
+    readonly record_json?: unknown;
+};
 export declare class CloudflareD1VersionedJsonRecordStoreError extends Error {
     readonly code: 'invalid_record' | 'invalid_response' | 'request_failed';
     constructor(code: 'invalid_record' | 'invalid_response' | 'request_failed', message: string);
@@ -66,7 +70,8 @@ export declare class CloudflareD1VersionedJsonRecordStore<T> {
         readonly limit?: number;
     }): Promise<readonly CloudflareD1VersionedJsonRecordReadManyEntryV1<T>[]>;
     readMany(keys: readonly string[]): Promise<readonly CloudflareD1VersionedJsonRecordReadManyEntryV1<T>[]>;
-    private parseReadResult;
+    prepareRead(key: string): D1PreparedStatementLike;
+    parseReadResult(result: D1ResultLike<StoredRecord> | undefined): VersionedJsonRecordReadResult<T>;
     put(key: string, value: T, expectedVersion: string | null): Promise<VersionedJsonRecordPutResult>;
     /**
      * Applies multiple records in one D1 transaction. The guard statement turns
@@ -80,7 +85,7 @@ export declare class CloudflareD1VersionedJsonRecordStore<T> {
      * commit spans this JSON store and a normalized table (for example, a
      * recovery envelope plus its WebAuthn authenticator and binding).
      */
-    putManyWithAdditionalStatements(mutations: readonly CloudflareD1VersionedJsonRecordMutationV1<T>[], additionalStatements: readonly D1PreparedStatementLike[]): Promise<CloudflareD1VersionedJsonRecordBatchPutResultV1>;
+    putManyWithAdditionalStatements(mutations: readonly CloudflareD1VersionedJsonRecordMutationV1<T>[], additionalStatements: readonly D1PreparedStatementLike[], executeBatch?: (statements: readonly D1PreparedStatementLike[]) => Promise<readonly D1ResultLike[]>): Promise<CloudflareD1VersionedJsonRecordBatchPutResultV1>;
     /**
      * The same mutation + CAS-guard statements `putManyWithAdditionalStatements`
      * would run, returned instead of executed, so a caller whose transaction is
@@ -96,7 +101,8 @@ export declare class CloudflareD1VersionedJsonRecordStore<T> {
     private findBatchConflict;
     private insert;
     private update;
-    private storageKey;
+    storageKey(key: string): string;
 }
 export declare function createCloudflareD1VersionedJsonRecordStore<T>(options: CloudflareD1VersionedJsonRecordStoreOptions<T>): CloudflareD1VersionedJsonRecordStore<T>;
+export {};
 //# sourceMappingURL=d1VersionedJsonRecordStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/authorizationSnapshotLayout.d.ts

@@ -0,0 +1,21 @@
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+declare const TABLES: readonly ["wallet_email_otp_rate_limits", "email_otp_wallet_enrollments", "email_otp_auth_states", "wallets", "wallet_signers", "wallet_recovery_code_locators", "wallet_authorities", "wallet_auth_methods", "wallet_relocation_approvals", "webauthn_credential_bindings", "webauthn_authenticators", "router_ab_yao_versioned_json_records", "authorization_wallet_session_quotas", "wallet_session_authorizations_v2", "wallet_session_hosted_credentials_v2", "wallet_session_hosted_exchange_codes_v2", "verified_wallet_operation_evidence_sets", "authorized_operations", "authorized_operation_audit_events", "linked_device_sessions", "linked_device_authority_allocations", "linked_device_authority_installations", "linked_device_target_credentials", "linked_device_target_commit_reservations", "linked_device_session_transcripts", "linked_device_ed25519_export_root_transfers", "linked_device_email_otp_grants", "linked_device_request_proof_nonces", "linked_device_bootstrap_imports", "linked_device_wallet_session_credential_deliveries_v1"];
+type Table = (typeof TABLES)[number];
+export declare class AuthorizationSnapshotLayout {
+    #private;
+    readonly table: Table;
+    readonly columns: readonly string[];
+    readonly keyColumns: readonly string[];
+    private constructor();
+    static read(database: D1DatabaseLike): Promise<readonly AuthorizationSnapshotLayout[]>;
+    static parse(raw: unknown): readonly AuthorizationSnapshotLayout[];
+    expressions(): {
+        readonly key: string;
+        readonly record: string;
+        readonly ownership: string;
+    };
+    snapshotSelection(): string;
+    static ownership(table: Table): string;
+}
+export {};
+//# sourceMappingURL=authorizationSnapshotLayout.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAddSignerFinalizeRecord.d.ts

@@ -0,0 +1,27 @@
+import type { WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import type { WalletAddSignerFinalizeResponse } from '../../../../core/registrationContracts';
+import type { StoredWalletAddSignerFinalizeRequest, StoredWalletAddSignerCeremony } from '../../../../core/RegistrationCeremonyStore';
+import { type RouterAbEd25519YaoRegistrationSideEffectStoreV1, type RouterAbEd25519YaoRegistrationSideEffectRecordV1 } from '../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary';
+export type D1WalletAddSignerFinalizePreparedV1 = {
+    readonly walletId: WalletId;
+    readonly kind: 'd1_wallet_add_signer_finalize_ed25519_prepared_v1';
+    readonly finalizingAtMs: number;
+    readonly signerWriteAtMs?: never;
+} | {
+    readonly walletId: WalletId;
+    readonly kind: 'd1_wallet_add_signer_finalize_ecdsa_prepared_v1';
+    readonly signerWriteAtMs: number;
+    readonly finalizingAtMs?: never;
+};
+export type D1WalletAddSignerFinalizeSideEffectStore = RouterAbEd25519YaoRegistrationSideEffectStoreV1<WalletAddSignerFinalizeResponse, D1WalletAddSignerFinalizePreparedV1>;
+export type D1WalletAddSignerFinalizeSideEffectRecord = RouterAbEd25519YaoRegistrationSideEffectRecordV1<WalletAddSignerFinalizeResponse, D1WalletAddSignerFinalizePreparedV1>;
+export declare function parseD1WalletAddSignerFinalizeSideEffectRecord(raw: unknown): D1WalletAddSignerFinalizeSideEffectRecord | null;
+export declare function fingerprintD1WalletAddSignerFinalizePrepared(prepared: D1WalletAddSignerFinalizePreparedV1): Promise<string>;
+export declare function returnD1WalletAddSignerFinalizePrepared(prepared: D1WalletAddSignerFinalizePreparedV1): Promise<D1WalletAddSignerFinalizePreparedV1>;
+export declare function rejectUnexpectedWalletAddSignerFinalizePreparation(): Promise<never>;
+export declare function buildD1WalletAddSignerFinalizePrepared(input: {
+    readonly request: StoredWalletAddSignerFinalizeRequest;
+    readonly ceremony: StoredWalletAddSignerCeremony;
+    readonly nowMs: number;
+}): D1WalletAddSignerFinalizePreparedV1;
+//# sourceMappingURL=d1WalletAddSignerFinalizeRecord.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAddSignerService.d.ts

@@ -1,3 +1,5 @@
+import type { WalletExecutionAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
+import { type D1WalletAddSignerFinalizeSideEffectStore } from './d1WalletAddSignerFinalizeRecord';
 import type { WalletAddSignerStartSuccess } from '../../../../core/registrationContracts';
 import type { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 } from '../ed25519Yao/d1Ed25519YaoLifecycleDecisionStore';
 import type { WalletAddSignerFinalizeRequest, WalletAddSignerFinalizeResponse, WalletAddSignerEcdsaActivationRequest, WalletAddSignerEcdsaActivationResponse, WalletAddSignerEcdsaDerivationRespondRequest, WalletAddSignerEcdsaDerivationRespondResponse, WalletAddSignerStartRequest, WalletAddSignerStartResponse } from '../../../../core/registrationContracts';
@@ -56,18 +58,9 @@ type D1WalletAddSignerStartTerminalV1 = {
 };
 export type D1WalletAddSignerStartSideEffectStore = RouterAbEd25519YaoRegistrationSideEffectStoreV1<D1WalletAddSignerStartTerminalV1, D1WalletAddSignerStartPreparedV1>;
 export type D1WalletAddSignerStartSideEffectRecord = RouterAbEd25519YaoRegistrationSideEffectRecordV1<D1WalletAddSignerStartTerminalV1, D1WalletAddSignerStartPreparedV1>;
-export type D1WalletAddSignerFinalizePreparedV1 = {
-    readonly kind: 'd1_wallet_add_signer_finalize_ed25519_prepared_v1';
-    readonly finalizingAtMs: number;
-} | {
-    readonly kind: 'd1_wallet_add_signer_finalize_ecdsa_prepared_v1';
-    readonly signerWriteAtMs: number;
-};
-export type D1WalletAddSignerFinalizeSideEffectStore = RouterAbEd25519YaoRegistrationSideEffectStoreV1<WalletAddSignerFinalizeResponse, D1WalletAddSignerFinalizePreparedV1>;
-export type D1WalletAddSignerFinalizeSideEffectRecord = RouterAbEd25519YaoRegistrationSideEffectRecordV1<WalletAddSignerFinalizeResponse, D1WalletAddSignerFinalizePreparedV1>;
 export declare function parseD1WalletAddSignerStartSideEffectRecord(raw: unknown): D1WalletAddSignerStartSideEffectRecord | null;
-export declare function parseD1WalletAddSignerFinalizeSideEffectRecord(raw: unknown): D1WalletAddSignerFinalizeSideEffectRecord | null;
 export declare class CloudflareD1WalletAddSignerService {
+    private readonly executionAuthority;
     private readonly getRegistrationCeremonyIntentStore;
     private readonly getEd25519YaoProductRegistration;
     private readonly ecdsaStrictRegistration;
@@ -79,6 +72,7 @@ export declare class CloudflareD1WalletAddSignerService {
     private readonly finalizeSideEffects;
     private readonly yaoLifecycleDecisions;
     constructor(input: {
+        readonly executionAuthority: WalletExecutionAuthority;
         readonly getRegistrationCeremonyIntentStore: RegistrationCeremonyStoreProvider;
         readonly getEd25519YaoProductRegistration: Ed25519YaoProductRegistrationProvider;
         readonly ecdsaStrictRegistration: RouterAbEcdsaStrictRegistrationPort;

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthMethodService.d.ts

@@ -1,6 +1,6 @@
 import { type WebAuthnCredentialIdB64u, type WebAuthnRpId, type WalletAuthMethodId, type WalletAuthorityId } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type AddAuthMethodIntentGrant, type AddAuthMethodIntentV1, type AddSignerIntentV1, type RegistrationIntentV1, type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
-import { type ActivePasskeyWalletAuthMethodRecordV2, type ActiveWalletAuthMethodRecordV2, type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+import { type ActivePasskeyWalletAuthMethodRecordV2, type ActiveWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import { type RegistrationAuthority } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import { type EmailOtpWalletAuthAuthority, type PasskeyWalletAuthAuthority, type WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
 import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
@@ -11,7 +11,7 @@ import { EMAIL_OTP_CHANNEL } from '../../../../../../shared-ts/src/utils/emailOt
 import { CloudflareD1EmailOtpChallengeVerifier } from '../emailOtp/d1EmailOtpChallengeVerifier';
 import type { CloudflareD1EmailOtpRegistrationEnrollmentFinalizer } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
 import { CloudflareD1RegistrationCeremonyIntentStore } from '../registration/d1RegistrationCeremonyStore';
-import type { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from '../emailOtp/d1GoogleEmailOtpRegistrationAttemptStore';
+import type { GoogleEmailOtpRegistrationAttemptStore } from '../emailOtp/d1GoogleEmailOtpRegistrationAttemptStore';
 import { type D1FreshRevokeWebAuthnVerifierV1, type D1AddAuthMethodExistingAuthResolution, type D1AddSignerExistingAuthResolution } from './d1WalletAuthMethodBoundary';
 import type { CloudflareD1WebAuthnStore } from '../webauthn/d1WebAuthnStore';
 import type { WalletEd25519SignerRecord } from '../../../../core/WalletStore';
@@ -116,7 +116,7 @@ export declare class CloudflareD1WalletAuthMethodService {
         readonly emailOtpEnrollmentFinalizer: CloudflareD1EmailOtpRegistrationEnrollmentFinalizer;
         readonly getRegistrationCeremonyIntentStore: RegistrationCeremonyStoreProvider;
         readonly getWalletAuthMethodStore: WalletAuthMethodStoreProvider;
-        readonly googleEmailOtpRegistrationAttempts: CloudflareD1GoogleEmailOtpRegistrationAttemptStore;
+        readonly googleEmailOtpRegistrationAttempts: GoogleEmailOtpRegistrationAttemptStore;
         readonly passkeyCustodyEnvelopes: CloudflareD1PasskeyCustodyEnvelopeStore;
         readonly sha256Bytes: Sha256Bytes;
         readonly webAuthnStore: CloudflareD1WebAuthnStore;
@@ -332,15 +332,11 @@ export declare class CloudflareD1WalletAuthMethodService {
      * Ed25519 leg arrives, so that leg must address the same rows.
      */
     readActiveRegistrationIdentity(authority: RegistrationAuthority): Promise<{
-        readonly walletAuthorityId: WalletAuthMethodRecordV2['walletAuthorityId'];
-        readonly walletAuthMethodId: WalletAuthMethodRecordV2['walletAuthMethodId'];
+        readonly walletAuthorityId: WalletAuthorityId;
+        readonly walletAuthMethodId: WalletAuthMethodId;
         readonly authority: ActiveWalletAuthorityV1;
         readonly authMethod: ActiveWalletAuthMethodRecordV2;
     } | null>;
-    readActiveRegistrationAuthority(authority: RegistrationAuthority): Promise<{
-        readonly authority: ActiveWalletAuthorityV1;
-        readonly walletAuthMethodId: WalletAuthMethodId;
-    } | null>;
     /**
      * Verifies a revocation's source proof: bound to this operation, and from a
      * different active method on an active full-owner authority. An Email OTP

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthorityStore.d.ts

@@ -2,6 +2,7 @@ import { type ActiveWalletAuthorityV1, type PendingWalletAuthorityV1, type Walle
 import { type DeviceId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
 import { type WalletAuthorityId, type WalletAuthMethodId, type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type ActiveWalletAuthMethodRecordV2, type RevokedWalletAuthMethodRecordV2, type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+import type { RegistrationAuthority } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
 import { type WalletSignerRecord } from '../../../../core/d1WalletStore';
 export type D1WalletAuthorityStoreScope = {
@@ -101,8 +102,6 @@ export declare class WalletAuthorityCommitConflictError extends Error {
 export declare class D1WalletAuthorityStore {
     private readonly database;
     private readonly scope;
-    private readonly ensureSchemaOnUse;
-    private schemaReady;
     constructor(input: {
         readonly database: D1DatabaseLike;
         readonly scope?: D1WalletAuthorityStoreScope;
@@ -110,9 +109,7 @@ export declare class D1WalletAuthorityStore {
         readonly orgId?: string;
         readonly projectId?: string;
         readonly envId?: string;
-        readonly ensureSchema?: boolean;
     });
-    private ensureSchema;
     /**
      * Commits an added signer: its signer records, the authority extended with
      * its activation, and every live Wallet Session of that authority promoted to
@@ -127,6 +124,13 @@ export declare class D1WalletAuthorityStore {
         readonly promotionAtMs: number;
     }): Promise<void>;
     readById(authorityId: WalletAuthorityId): Promise<WalletAuthorityV1 | null>;
+    /** Reads the method and its authority from one database snapshot. */
+    readActiveRegistrationIdentity(expected: RegistrationAuthority): Promise<{
+        readonly walletAuthorityId: WalletAuthorityId;
+        readonly walletAuthMethodId: WalletAuthMethodId;
+        readonly authority: ActiveWalletAuthorityV1;
+        readonly authMethod: ActiveWalletAuthMethodRecordV2;
+    } | null>;
     readByWalletAndDevice(input: {
         readonly walletId: WalletId;
         readonly deviceId: DeviceId;

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthorizationCleanup.d.ts

@@ -0,0 +1,20 @@
+import { type D1TenantScope } from '../../../../core/d1TenantStore';
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import { WalletRelocationSessionSource } from './d1WalletRelocationSessions';
+type CleanupProgress = {
+    readonly state: 'cleaning';
+    readonly completedAtMs?: never;
+} | {
+    readonly state: 'cleaned';
+    readonly completedAtMs: number;
+};
+export declare class D1WalletAuthorizationCleanup {
+    private readonly database;
+    private readonly scope;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope);
+    advance(source: WalletRelocationSessionSource, rawManifest: unknown, commandDigest: string, nowMs: number): Promise<CleanupProgress>;
+    private manifest;
+    private read;
+}
+export {};
+//# sourceMappingURL=d1WalletAuthorizationCleanup.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthorizationFreeze.d.ts

@@ -0,0 +1,12 @@
+import { type D1TenantScope } from '../../../../core/d1TenantStore';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import { WalletRelocationSessionSource } from './d1WalletRelocationSessions';
+export declare class D1WalletAuthorizationFreeze {
+    private readonly database;
+    private readonly scope;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope);
+    freeze(source: WalletRelocationSessionSource, nowMs: number): Promise<number>;
+    freezeStatements(source: WalletRelocationSessionSource, nowMs: number): readonly D1PreparedStatementLike[];
+    private read;
+}
+//# sourceMappingURL=d1WalletAuthorizationFreeze.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthorizationHistory.d.ts

@@ -0,0 +1,20 @@
+import { type D1TenantScope } from '../../../../core/d1TenantStore';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import { AuthorizationSnapshotLayout } from './authorizationSnapshotLayout';
+import { WalletRelocationSessionSource } from './d1WalletRelocationSessions';
+export declare class D1WalletAuthorizationHistory {
+    private readonly database;
+    private readonly scope;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope);
+    prepare(source: WalletRelocationSessionSource): Promise<void>;
+    restoreSnapshot(source: WalletRelocationSessionSource, records: readonly {
+        readonly table: AuthorizationSnapshotLayout;
+        readonly recordKey: string;
+        readonly recordJson: string;
+    }[], completion: readonly D1PreparedStatementLike[]): Promise<void>;
+    private restoreStatements;
+    private closeStatements;
+    private readImport;
+    private validateRow;
+}
+//# sourceMappingURL=d1WalletAuthorizationHistory.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthorizationIntake.d.ts

@@ -0,0 +1,29 @@
+import { type D1TenantScope } from '../../../../core/d1TenantStore';
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import { WalletRelocationSessionSource } from './d1WalletRelocationSessions';
+type IntakeProgress = {
+    readonly state: 'receiving';
+    readonly nextIndex: number;
+    readonly chunkCount: number;
+    readonly digestHex?: never;
+} | {
+    readonly state: 'verified';
+    readonly digestHex: string;
+    readonly nextIndex?: never;
+    readonly chunkCount?: never;
+};
+export declare class D1WalletAuthorizationIntake {
+    private readonly database;
+    private readonly scope;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope);
+    prepare(source: WalletRelocationSessionSource, rawManifest: unknown): Promise<IntakeProgress>;
+    acceptSnapshot(source: WalletRelocationSessionSource, raw: unknown): Promise<string>;
+    activate(source: WalletRelocationSessionSource, rawManifest: unknown, commandDigest: string, nowMs: number): Promise<{
+        readonly digestHex: string;
+        readonly activatedAtMs: number;
+    }>;
+    private readActivation;
+    private read;
+}
+export {};
+//# sourceMappingURL=d1WalletAuthorizationIntake.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthorizationSnapshot.d.ts

@@ -0,0 +1,31 @@
+import { type D1TenantScope } from '../../../../core/d1TenantStore';
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import { WalletRelocationSessionSource } from './d1WalletRelocationSessions';
+export declare const AUTHORIZATION_SNAPSHOT_MAX_BYTES = 524288;
+export declare const AUTHORIZATION_SNAPSHOT_MAX_CHUNKS = 80;
+type Manifest = {
+    readonly schemaJson: string;
+    readonly chunkCount: number;
+    readonly recordCount: number;
+    readonly digestHex: string;
+};
+export declare class D1WalletAuthorizationSnapshot {
+    private readonly database;
+    private readonly scope;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope);
+    seal(source: WalletRelocationSessionSource): Promise<Manifest>;
+    exportSnapshot(source: WalletRelocationSessionSource): Promise<readonly {
+        readonly index: number;
+        readonly chunkJson: string;
+        readonly digestHex: string;
+    }[]>;
+    assertCapacity(walletId: string): Promise<void>;
+    private prepare;
+    private read;
+    private readProgress;
+    private nextRecord;
+    private readSegment;
+    private storeChunk;
+}
+export {};
+//# sourceMappingURL=d1WalletAuthorizationSnapshot.d.ts.map